Social
Combines 429 rate limiting with checkpoint flows that interrupt an account rather than a request, so the block attaches to the identity rather than the connection.
Meta's platforms handle automation at the account layer as much as at the request layer. Alongside conventional 429 rate limiting, Instagram uses checkpoints: a state attached to the account that requires verification before anything else proceeds. Changing address or client does not clear a checkpoint, because the constraint is not on the connection.
That is the important distinction for anyone diagnosing these failures. Most of this glossary is about requests being judged. Here, once a checkpoint is set, the account itself is held, and every request from it returns the same interruption regardless of where it comes from.
Meta operates Graph API products for business and creator accounts, which are the supported route for programmatic access.
What is in front of it
- Meta's in-house systems. No third-party bot vendor is involved.
- Enforcement is applied at the account level as well as at the request level.
Status codes
429 Rate limited
Rate limited. Observed behaviour.
Request volume exceeded for the account, the address, or both.
What triggers it
- Sustained automated requests.
- Repeated identical actions with machine-like timing.
How to confirm it
- 429 with limited body detail, sometimes with retry-after.
What to do about it
- Back off substantially. Limits here are enforced over long windows, and short retries prolong the state rather than resolving it.
400 Checkpoint required
Blocked. Observed behaviour.
The account has been flagged and must complete verification. The hold is on the identity, not on the request.
What triggers it
- Automated activity attributed to the account.
- A sudden change in location or device for the session.
How to confirm it
- A body indicating a checkpoint or challenge requirement rather than a conventional error.
What to do about it
- Do not rotate addresses. The state belongs to the account and will follow it anywhere, so changing connection only adds a location change to the record.
- Complete the verification through the official interface.
Notes
- Account-level enforcement behaves nothing like address-level enforcement. Diagnose which one you are facing before choosing a response.
- Automated collection of personal data raises privacy obligations under regimes such as GDPR that are entirely separate from the platform's own terms.